{"id":"CVE-2024-54021","aliases":["EUVD-2024-52244","GHSA-v8p8-w9q2-q67j"],"status":"published","title":"An improper neutralization of crlf sequences in http headers ('http response splitting') in...","description":"An Improper Neutralization of CRLF Sequences in HTTP Headers ('http response splitting') vulnerability [CWE-113] in Fortinet FortiOS 7.2.0 through 7.6.0, FortiProxy 7.2.0 through 7.4.5 may allow a remote unauthenticated attacker to bypass the file filter via crafted HTTP headers.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:F/RL:X/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00763,"percentile":0.55827,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-113","CWE-436"],"published":"2025-01-14T14:09:48Z","modified":"2026-06-17T08:09:41Z","products":[{"vendor":"fortinet","product":"fortios"},{"vendor":"fortinet","product":"fortiproxy"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-282","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-54021"},{"url":"https://github.com/advisories/GHSA-v8p8-w9q2-q67j"}],"sources":{"cve":[{"id":"CVE-2024-54021","description":"An Improper Neutralization of CRLF Sequences in HTTP Headers ('http response splitting') vulnerability [CWE-113] in Fortinet FortiOS 7.2.0 through 7.6.0, FortiProxy 7.2.0 through 7.4.5 may allow a remote unauthenticated attacker to bypass the file filter via crafted HTTP headers.","status":"published","published":"2025-01-14T14:09:48.859Z","modified":"2025-08-06T18:04:37.181Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:F/RL:X/RC:C","level":"medium","assessor":"cna"}],"cwes":["CWE-113"],"updated_at":"2026-11-02T14:33:59.177173Z"}],"euvd":[{"id":"EUVD-2024-52244","description":"An Improper Neutralization of CRLF Sequences in HTTP Headers ('http response splitting') vulnerability [CWE-113] in Fortinet FortiOS 7.2.0 through 7.6.0, FortiProxy 7.2.0 through 7.4.5 may allow a remote unauthenticated attacker to bypass the file filter via crafted HTTP headers.","status":"published","published":"2025-01-14T14:09:48Z","modified":"2025-08-06T18:04:37Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:F/RL:X/RC:C","level":"medium"}],"updated_at":"2026-11-02T20:32:00.811941Z"}],"ghsa":[{"id":"GHSA-v8p8-w9q2-q67j","title":"An improper neutralization of crlf sequences in http headers ('http response splitting') in...","description":"An improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS 7.2.0 through 7.6.0, FortiProxy 7.2.0 through 7.4.5 allows attacker to execute unauthorized code or commands via crafted HTTP header.","status":"published","published":"2025-01-14T15:30:54Z","modified":"2025-02-04T00:33:09Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-113","CWE-436"],"updated_at":"2026-11-02T14:59:46.595818Z"}],"nvd":[{"id":"CVE-2024-54021","description":"An Improper Neutralization of CRLF Sequences in HTTP Headers ('http response splitting') vulnerability [CWE-113] in Fortinet FortiOS 7.2.0 through 7.6.0, FortiProxy 7.2.0 through 7.4.5 may allow a remote unauthenticated attacker to bypass the file filter via crafted HTTP headers.","status":"published","published":"2025-01-14T14:15:34.287Z","modified":"2026-06-17T08:09:41.367Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-113"],"updated_at":"2026-11-02T14:10:42.329342Z"}]}}